DOCSEARCHbyAlgolia
Submit Docs

NetExec Documentation

repository·main·Indexed 26 days ago

https://github.com/pennyw0rth/netexec

NetExec (nxc) is a community-driven network execution tool evolved from CrackMapExec, used by security professionals for enumeration and execution tasks across protocols such as SMB, SSH, RDP, MSSQL, WinRM, FTP, LDAP, and others. It features a CLI for module management, authentication (including Kerberos and certificates), and PowerShell obfuscation. The tool includes NXCDB, an interactive database navigator for managing workspaces and exporting discovered data like credentials, shares, and host information.

Tokens
1.3K
Snippets
1
Records
19
Agent score
91%

What's inside NetExec

  1. Install NetExec on Linux

    main

    To install NetExec on a Linux system, use pipx to install directly from the GitHub repository. This ensures you are using the latest version. You will need pipx and git installed on your system first.

    sudo apt install pipx git
pipx ensurepath
pipx install git+https://github.com/Pennyw0rth/NetExec

  3. Use NXCDB to manage and export NetExec results

    main
    NXCDB is an interactive database navigator for NetExec. It allows you to manage different workspaces and switch between protocol-specific databases (e.g., SMB, MSSQL, WinRM) to inspect, export, and import data discovered during network execution tasks.

  4. Execute NetExec via CLI

    main

    NetExec is a network execution tool that requires a protocol to be specified. The tool supports various protocols (e.g., ssh, rdp, smb) and can execute modules against targets.

    Key Requirements:

    • A protocol must be provided.
    • For ssh protocol: If using a --key-file, a password (-p) is still required. If there is no passphrase, use -p ''.
    • For Kerberos (--use-kcache): The KRB5CCNAME environment variable must be set.
    • For rdp protocol: Using --execute will prompt for confirmation as it may disconnect active Windows sessions.

  5. Specify targets in NetExec

    main

    NetExec supports multiple ways to define targets:

    1. Direct Input: Provide IP addresses or hostnames directly.
    2. Files: Provide a path to a file containing targets. NetExec will parse the file.
    3. Nmap XML: If the target file is an Nmap XML output, NetExec will parse it for targets.
    4. Nessus Files: If the target file is a Nessus file, NetExec will parse it for targets.

  6. Manage workspaces in NXCDB

    main

    Workspaces allow you to isolate different sets of NetExec results. You can manage them via the interactive prompt or CLI flags.

    Interactive Commands:

    • workspace create <targetName>: Creates a new workspace named <targetName>.
    • workspace list: Lists all available workspaces. The current workspace is marked with an asterisk *.
    • workspace <targetName>: Switches the current workspace to <targetName>.

    CLI Flags:

    • --create-workspace <name>: Create a new workspace and exit.
    • --set-workspace <name>: Set the current workspace and exit.
    • --get-workspace: Lists workspaces, highlighting the current one.

  7. Import Empire credentials into NXCDB

    main

    You can import credentials from a running Empire instance into your current NXCDB workspace via the RESTful API.

    Command:

    • import empire

    Requirements: This command relies on the Empire section in your NetExec configuration file, which must contain:

    • api_host
    • api_port
    • username
    • password

  8. Export data from NXCDB

    main

    Use the export command within the protocol-specific navigator to save discovered information to a file. Most commands support simple or detailed modes, and some support specific formats.

    Syntax: export <command> [simple|detailed|*] <filename>

    Available Export Commands:

    • creds: Export credentials. Options: simple, detailed, or hashcat (outputs user:pass format).
    • hosts: Export host information. Options: simple, detailed, or signing (outputs a list of IPs where signing is enabled).
    • shares: Export discovered shares. Options: simple, detailed.
    • local_admins: Export local administrator relations. Options: simple, detailed.
    • dpapi: Export DPAPI secrets. Options: simple, detailed.
    • keys: Export writable registry keys. Options: all or <id>.
    • wcc: Export WCC check results. Options: simple, detailed.
    • plaintext: (Available via tab-completion)